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Abstract — We develop the proposal of non-systematic channel 
codes on the AWGN wire-tap channel. Such coding technique, 
based on scrambling, achieves high transmission security with a 
small degradation of the eavesdropper's channel with respect 
to the legitimate receiver's channel. In this paper, we show 
that, by implementing scrambling and descrambling on blocks of 
concatenated frames, rather than on single frames, the channel 
degradation needed is further reduced. The usage of concatenated 
scrambling allows to achieve security also when both receivers 
experience the same channel quality. However, in this case, the 
introduction of an ARQ protocol with authentication is needed. 

I. Introduction 

A very simple model that is well suited to represent physical 
layer security schemes is the wire-tap channel [1], in which 
a transmitter (Alice) sends information to the legitimate re- 
ceiver (Bob), but this is also received by the eavesdropper 
(Eve). Alice can adopt whatever randomization, encoding and 
modulation scheme before transmitting her message, and both 
Bob and Eve are perfectly aware of the transmission technique 
she uses; so, at least in principle, they are both able to recover 
the Ik k message vector (u) from the 1 x n codeword vector 
(c). However, the channel that separates Alice from Bob is 
generally different from that between Alice and Eve. For this 
reason, the codeword received by Bob (cb) is not equal to 
that gathered by Eve (ce). So, after inverting the encoding 
map, the message obtained by Bob (ub) can differ from that 
recovered by Eve (ue). 

Under an information theoretic viewpoint, the wire-tap 
channel can be described through the secrecy capacity, defined 
as the highest transmission rate at which Bob can achieve 
arbitrarily small error probability while Eve has no information 
on the transmitted message. In this study, we are interested in 
the Additive White Gaussian Noise (AWGN) wire-tap channel, 
for which the secrecy capacity equals the difference between 
the two channel capacities [2]. So, transmission security can 
be achieved only on condition that Bob's AWGN channel 
has higher signal-to-noise ratio (SNR) with respect to Eve's 
AWGN channel. On the other hand, in [3] it was shown that 
physical layer security is attainable even when Bob's SNR 
is lower than Eve's SNR, but this requires the presence of a 
feedback channel between Alice and Bob (also accessible to 
Eve). In this paper, we consider Automatic Repeat reQuest 
(ARQ) protocols [4], that exploit a very simple feedback 
mechanism, based on checking the integrity of all frames and 



sending acknowledgment (or non-acknowledgment) messages 
from the receiver back to the transmitter. 

The concept of secrecy capacity is based on limit values, 
and can be seen as a bound when using real transmission 
techniques. On the other hand, in real cases, it is interesting 
to estimate the channel degradation that is needed to reach a 
fixed level of physical layer security, though not achieving the 
secrecy capacity. Furthermore, the secrecy capacity assumes 
that both receivers use optimal decoders. Under a crypto- 
graphic viewpoint, the assumption of providing an attacker 
with an optimal decoder would also be useful for estimating 
the minimum security level of the system. However, this is not 
necessary with the aim to make a comparison among different 
transmission techniques. For this purpose, it is meaningful 
to suppose that both Bob and Eve use the same decoding 
technique. If Eve would adopt a more efficient decoder, we 
can expect that the conclusion of the comparative analysis 
among different techniques does not change. 

Based on these premises, our analysis is focused on a 
parameter named security gap, that expresses the quality 
difference between Bob's and Eve's channels that is required 
to achieve a sufficient level of physical layer security when 
both them implement the same receiver. An important target 
is to keep the security gap as small as possible, in such a way 
as to achieve high physical layer security even with a small 
degradation of Eve's channel with respect to Bob's one. 

Some previous works have been devoted to the study of 
what transmission techniques are best suited to reduce the 
security gap. In particular, in [5], the authors propose the 
usage of punctured codes, by associating the secret bits to 
punctured bits. They consider punctured LDPC codes and 
prove that such technique, for a fixed rate, is able to guarantee 
a considerable reduction in the security gap with respect to 
non-punctured (systematic) transmission. Recently, we have 
proposed an alternative solution, based on non-systematic 
coding implemented through scrambling of the information 
bits [6]. Such kind of coded transmission is able to achieve a 
strong reduction in the security gap, that becomes comparable 
(and even better) than that obtained through puncturing. 

In this paper, we consider different coded transmission 
techniques over the AWGN channel with Binary Phase Shift 
Keying (BPSK) and investigate how the security gap can be 
reduced by introducing concatenation within scrambling. In 
this case, the information frames are grouped into blocks 



and scrambled/descrambled together, so increasing the error 
propagation effect for the unauthorized receiver. As a further 
contribution, we show that, when there is no gap between 
Bob's and Eve's channels, security can still be achieved by 
resorting to an ARQ protocol with authentication by Bob. In 
such case, only Bob can request for retransmission of a frame, 
that, however, is also received by Eve. 

The paper is organized as follows. In Section II we remind 
the main concepts and definitions of scrambled codes for the 
wire-tap channel; in Section III we study the case of terror 
correcting codes under hard-decision decoding; in Section 
IV we consider LDPC codes as an example of codes with 
soft-decision decoding; in Section V we describe the system 
adopting scrambled codes together with ARQ; finally, Section 
VI concludes the paper. 

II. Scrambled codes for the wire-tap channel 

Given the k x n generator matrix of an (n, /c)-linear block 
code in systematic form G = [I|C], and a non-singular k x k 
binary scrambling matrix S, Alice performs encoding as c = 
u • S • G, that is, by replacing the information vector u with 
its scrambled version u' = u • S before applying the code. 

If Bob's channel quality is sufficiently high, Bob has a high 
probability to correct all errors, thus recovering, after descram- 
bling, ub = u = c; • S _1 , where c; is the vector containing 
the first k bits of c. On the other hand, at the output of the 
descrambler, Eve has ug = u + e; • S _1 , where e; is the left 
part of Eve's residual error vector e = [ej|e r ]. So, if matrix S 
is suitably chosen, descrambling has the effect of propagating 
the residual errors after decoding. A sufficient level of security 
is achieved when Bob's and Eve's energy per bit to noise 
power spectral density ratios (denoted by ^ 
respectively) are such that Bob's bit error probal 
than a given threshold, Pf < Pf ^ ^ , while Eve's one is 
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security gap is then defined, in dB, 

We obtain a first estimate of the scrambling effect "by 
studying an ideal case we denote as perfect scrambling: it 
models a scrambling technique that, in presence of one (or 
more) error(s), produces maximum uncertainty. Under the 
hypothesis of perfect scrambling, a single residual bit error 
in the decoded word is sufficient to ensure that half of the bits 
are in error after descrambling. In practice, perfect scrambling 
can always be approached by using S matrices with dense 
inverse (S _1 ), that is, with a density of 1 symbols next to 0.5. 

The propagation effect of scrambling matrices on residual 
errors can be further increased by implementing the scram- 
bling and descrambling operations on blocks of frames, rather 
than on single frames. Let us suppose to collect L consecutive 
information frames in a vector u = [ui |u 2 1 . . . |u_l]. Scram- 
bling can be directly applied on the whole L-frame block as: 



u' 



u - S, 



(1) 



where u' is the scrambled version of the L-frame block 
and S is a scrambling matrix with size kL x kL. After 



block scrambling, vector u' is divided into its components 
[u'Jugl . . . \u' L ], that are encoded and transmitted separately, 
as in the case without block scrambling. Both Bob and Eve 
must collect their received frames into blocks of L frames 
before applying the block descrambling matrix S . After 
descrambling, Eve gets a block of L information frames 
TIe = u + e[ • S , where e7 is the concatenation of the error 
vectors affecting the L information frames. 

It is evident that, by using descrambling on blocks of 
frames, its error propagation effect increases, since a single 
residual bit error in one of the L frames can be spread into 
all of them. We extend the concept of perfect scrambling 
by defining that, under the hypothesis of a perfect block 
scrambler, a single bit error in one of the L frames ensures 
that, after descrambling: i) all the L frames are in error and 
ii) half of the bits in each frame are erred. We will see in 
the following that the condition of perfect scrambling can be 
approached, even in such case, for practical choices of the 
system parameters. 

III. f-ERROR Correcting Coding 

Let us consider a hard-decision decoded (n, k) linear block 
code able to correct t bit errors. When such a coding scheme is 
adopted, the frame error probability, under bounded-distance 
decoding, can be estimated as Pf = Y^i=t+i u)-^o(l — 
Po)™ -4 , where Po is the channel bit error probability taking 
into account the bandwidth expansion due to the code, i.e., 
P = 1/2 • erfc ( y/E b /N • k/n^j . 

When scrambling is performed over single frames, the 
frame error probability is the same as for the unscrambled 
transmission; so, in presence of perfect scrambling, the bit 
error probability after descrambling is: 
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In order to remove the hypothesis of perfect scrambling, we 
consider a real descrambling matrix S _1 with column weight 
w < k and denote: by Pj the probability that a received k- 
bit vector contains j errors before descrambling; by P^j the 
probability that exactly i out of j errors are selected by a 
weight w column of S . Under such assumptions, the bit 
error probability on each received bit, after descrambling, can 
be calculated as follows: 
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In (3), P, = ® £?=*+! (r?)^ 1 -^)"-* and P iy = 

(i) (_"'•) / ( )• We have observed in [6] that a density w/k w 
0.01 is enough to approach the effect of perfect scrambling. 

When scrambling is applied on blocks of L concatenated 
frames, its effect can still be evaluated by considering the 
perfect scrambling model. In this case, the frame and bit 




error probability after descrambling can be easily estimated 
as follows: 



pL-PS 
f 

pL-PS _ 1 pL-PS 



(4) 



When real block scrambling matrices are instead adopted, 
the bit error probability after block descrambling can be esti- 
mated starting from the bit error probability with single frame 
descrambling, given by (3). Let us consider, for simplicity, 
that the kL x kL block descrambling matrix has constant row 
and column weight wL, and it is formed by L x L square 
blocks with size k x k and row/column weight w. Under 
such assumption, each received bit after block descrambling 
can be seen as the sum of L received bits after single frame 
descrambling; so, its error probability can be estimated as: 
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(5) 



In order to evaluate the effect of concatenated scrambling 
on the security gap, we have considered a (n = 2047, k = 
1354, t = 69) BCH code and pj = 1CT 5 . Fig. 1 shows 
the values of P e E , as a function of the security gap, when 
scrambling is performed over blocks of concatenated frames 
with different size (L). As we observe from the figure, the 
introduction of concatenated scrambling reduces the security 
gap needed to reach high values of P e E with respect to the 
case without concatenation (L = 1). We also observe that the 
effect of a block descrambling matrix with row and column 
weight wL = 20L, for L > 2, approaches that of the 
corresponding perfect scrambler. The convergence to perfect 
scrambling would also improve by increasing w. 

IV. Non-Systematic LDPC codes 

As an example of Soft-In Soft-Out modern error correcting 
schemes, we consider LDPC codes, to which we apply the 
approach of non-systematic transmission based on scrambling. 
We consider an LDPC code with length n = 2364 and dimen- 
sion k = 1576, designed through the well-known Progressive 
Edge Growth (PEG) algorithm [7]. 



In the case of scrambling performed over single frames, 
non-systematic LDPC coded transmission has been obtained 
by adopting a dense 1576 x 1576 scrambling matrix, and 
we have verified it practically reaches the effect of a perfect 
scrambler. Also in this case, the security gap can be reduced 
by resorting to concatenated scrambling. Starting from the P/ 
values for the case with single frame scrambling, the effect of 
a perfect scrambler on blocks of L concatenated frames can 
be estimated by means of Eqs. (4). Fig. 2 shows the values 
of P E versus the security gap for P L P = 10~ 5 and different 
values of L. We have verified through numerical simulations 
that, by using real scrambling matrices with a high density 
of 1 symbols in their inverse, the effect of block scrambling 
is almost coincident with that predicted through the perfect 
scrambler approximation. 

V. Coded transmission with ARQ 

Coded transmission based on scrambling is able to strongly 
reduce the security gap with respect to systematic transmission 
[6]. However, physical layer security is still achievable only 
when Bob has a better channel than Eve. It is known from the 
literature that, when Bob's and Eve's channels have the same 
quality, or Eve's channel is even better than Bob's, a feedback 
mechanism is needed to achieve security [8], [9]. 

We investigate such case by considering a very common 
feedback mechanism, based on integrity checks and ARQ. 
Obviously, the request for retransmissions must be allowed for 
Bob only; so, this setting requires the existence of a form of 
authentication between Alice and Bob. However, retransmitted 
packets are also available to Eve, through her channel. 

Physical layer security on channels with ARQ has been 
already studied and it has been shown that a scheme based 
on ARQ can recover security of the wired equivalent privacy 
(WEP) protocol for wireless local area networks, otherwise 
vulnerable to total break attacks [10]. ARQ has also been 
recently used together with puncturing for physical layer secu- 
rity: in [9], the authors propose a scheme for using puncturing 
and ARQ on the wire-tap channel with packet erasures in such 
a way that the loss of a single packet is sufficient to prevent 
the eavesdropper from decoding the message. 



In this paper, we use ARQ together with Forward Error 
Correcting (FEC) codes, so we consider Hybrid ARQ (HARQ) 
schemes. Several implementations are possible for HARQ 
schemes: two main families are those using incremental re- 
dundancy [11] and soft-combining [12]; both of them have 
been implemented in a number of variants. When soft-decision 
maximum a posteriori probability (MAP) decoding algorithms 
are adopted, a common approach consists in using the relia- 
bility values obtained after each (failed) decoding attempt as a 
priori values for decoding the next replica of the same frame. 
Other variants (as that proposed in [12]) of such approach can 
be conceived that are able to improve the performance. 

However, this soft-combining strategy is only applicable 
with soft-decision decoding, while we are interested in eval- 
uating the performance of HARQ systems in less restrictive 
conditions. For this reason, we consider a HARQ scheme that 
exploits the simplest form of soft-combining: it consists in 
averaging the channel outputs, after multiple transmissions of 
the same frame. Such scheme is a valuable benchmark, since 
it can be implemented with whatever family of codes (ex- 
ploiting both hard and soft-decision decoding). More complex 
strategies of soft-combining could provide some improvement 
in performance, especially when the maximum number of 
allowed retransmissions is high (that is not the situation 
considered in this paper). In that case, Eve could get some 
advantage from adopting such more involved approaches. This 
will be the object of future work. 

In the HARQ protocol we consider, Bob can exploit a 
number of transmissions Q < Q max for decoding each frame 
and Eve receives all retransmissions requested by Bob. It 
should be noted that the integrity check mechanism, based 
on parity-checks, is exposed to undetected errors, that is, 
transitions of the received codeword to near codewords. In this 
case, integrity of the frame is erroneously verified. However, 
for long codes with rather high rate and error correction 
capability, undetected errors are extremely rare (as we have 
verified in our simulations). 

According with the description above, a first solution is to 
try decoding only on the average of the Q received replicas 
of each frame. A more "aggressive" approach (that could be 
adopted by Eve) is to try all possible averages of the Q 
received replicas of each frame. In this case, a further im- 
provement in performance can be achieved (though at the cost 
of increased complexity). In general terms, starting from the 
curve of Pf (Eb/N ) for the considered transmission scheme, 
the frame error probability when decoding is performed on 
the average of Q < <5 max independent transmissions can 
be modeled through an AWGN channel with noise variance 
divided by Q; so, it becomes: 



pf ] (E b /N Q ) = P f (E b /N ■ Q) . 



(6) 



In classical ARQ schemes, the frame error probability at 
each transmission of a given frame is independent of the 
others; so, the frame error probability after Q transmissions is 
simply the product of the Q frame error probabilities at each 
transmission. When using soft-combining, such hypothesis is 



no longer valid. For example, in the soft-combining strategy 
we adopt, since the second transmission of a frame is requested 
only upon a decoding failure on the first transmission, the 
decision variable is no longer Gaussian and (6) should be 
modified. However, as we have verified through simulations, 
the impact of such correction is negligible, at least for our 
choice of the system parameters; so, we adopt Pf\ expressed 
by (6), as an estimate of the frame error probability at the Q-th 
transmission of the considered HARQ protocol. 

In the system model we adopt, Bob is always able to request 
retransmission of a frame, when needed (i.e., after a decoding 
failure); so, the probability that he receives Q > 1 transmis- 
sions of a frame coincides with his frame error probability 
after Q — 1 transmissions, that is: 
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with Pj ^ = 1. On the contrary, when Eve, after a decoding 
failure, would need a frame retransmission, she is able to 
receive it only on condition that Bob has failed to decode 
the same frame. Then, the probability that she receives Q > 1 
(useful) transmissions of a frame is: 
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Based on (7) and (8), Bob's and Eve's frame error probability 
is: 
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In the following subsection, we present some results on the 
usage of the HARQ scheme, here described, with the i-error 
correcting codes and LDPC codes considered in the previous 
sections. 

A. ARQ with t-Error Correcting codes 

Fig. 3 shows the frame error probability curves, for the 
(2047,1354,69) BCH code, obtained through (9) and by 
numerical simulations. The maximum number of transmissions 
has been set <5 ma x = 2. As we observe from the figure, the 
analytical model fits very well the simulated data. From the 
frame error probability curves we can deduce the bit error 
probability performance in presence of scrambling, by using 
the simplifying hypothesis of perfect scrambling. 

From the figure we notice that Bob's and Eve's performance 
can be divided into three regions of SNR values: 

i) At low SNRs, Bob's channel quality is poor (Pj = 1). 
In this region, Bob requests retransmission of all frames, 
and Eve can benefit from this fact. So, Eve's perfor- 
mance is overlaid with Bob's one, and their error proba- 
bility curves have a gain of 3 dB (due to Q — Q max = 2) 
with respect to the case without ARQ, as expected. 

ii) When the channel quality is high enough that Bob 
requests few retransmissions (Pj 3 < 1), Eve misses most 




of the retransmissions she would need. Moreover, the 
channel quality is still not sufficient to allow correct 
decoding without ARQ, so her performance deteriorates. 
Bob's error probability curve continues to decrease 
towards very small values, while Eve's one grows, 
iii) For large SNR values, the channel quality becomes 
adequate to allow decoding with a single transmission 
of each frame, and Eve's performance tends to that of 
the system without ARQ. 
An important observation (that also justifies the interest for 
the frame error probability, in place of the bit error probability, 
as in the previous figures) is that, without resorting to concate- 
nated scrambling, HARQ is not able to achieve a sufficient 
level of physical layer security. In fact, in the region where 
Bob achieves low frame error probabilities, Eve's frame error 
probability is always too low to guarantee security. However, 
by using concatenated scrambling, the security condition can 
be recovered. 

For example, by means of Eqs. (4), we can easily estimate 
that, by using a concatenated scrambler with L = 20, the 
region of Pf > 1CT 1 (around 4 dB) translates into Pf > 0.87. 
In the same region, Bob's frame error probability is surely 
Pf < 10~ 6 , and it becomes Pf < 2 • 10~ 5 after the ap- 
plication of the concatenated scrambler. So, under the perfect 
scrambler assumption, it is Pf > 0.4 and Pf < 1 • 10~ 5 , that 
restores the desired security level. 

B. ARQ with LDPC codes 

A very similar situation is observed for ARQ with LDPC 
codes, whose frame error probability curves have been es- 
timated through numerical simulations and are reported in 
Fig. 4. From the figure we notice that Bob's and Eve's error 
probability curves have the same three-zone behavior observed 
for hard-decision decoded BCH codes. 

Also in this case, we observe the presence of a region 
(around 1.8 dB) where Eve's frame error probability is > 10 _1 
while Bob's one (according to the trend of the simulated curve) 
will become < 10~ 6 ; so, the application of a concatenated 
scrambler with L = 20 still allows to achieve the desired 
physical layer security. 



VI. Conclusion 

We have continued the study of codes with scrambling 
for physical layer security over the AWGN wire-tap channel. 
Our results show that the implementation of scrambling and 
descrambling on blocks of concatenated frames, rather than 
on single frames, can further reduce the security gap. 

By using concatenated scrambling in conjunction with a 
HARQ protocol with soft-combining, a sufficient level of 
physical layer security can also be ensured when Bob's and 
Eve's channels have the same quality. The same target could 
be reached even when Eve has a better channel than Bob; this 
aspect will be investigated in future works. 
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